Riba:
- Fahimtar yadudduka masu tsauri da tsauri kuma ku sami damar yin bambance-bambancen kirtani, bayanin rubutun da hakar IOC tare da hankali na wucin gadi.
- Ikon tuta alamu kamar abubuwan rashin ƙarfi da haske a cikin zirga-zirgar hanyar sadarwa ta hanyar tushe da tabbatar da kowane IOC
- Ƙarfin fahimtar cewa gano cutar malware hasashe ne kuma wannan bayanin za a yi amfani da shi ne kawai don tsaro da bincike mai izini kuma ba za a iya amfani da shi ba don samun izini mara izini ko tsara hari.
Wani abu da ya faru sau da yawa yana da malware a cibiyarsa - software da aka ƙera don lalata tsarin, satar bayanai, ko ɗaukar iko. "Me wannan fayil ɗin yake yi, ta yaya ya shiga tsarin, me ya sata, a ina ya sadar da waje?" Amsoshin waɗannan tambayoyin suna da mahimmanci don fahimtar abin da ya faru da kuma gabatar da shi a gaban kotu. Hakazalika, bincike-binciken cibiyar sadarwa-binciken wani lamari daga bayanan zirga-zirgar hanyar sadarwa-yana bayyana shigarwar maharin da fita. A cikin wannan rukunin, za mu rufe yadda AI ke haɓakawa a cikin waɗannan yankuna biyu kuma yakamata a yi amfani da shi kawai don tsaro, tabbatarwa, da dalilai na bita.
Iyakar farko: amfani da tsaro
Mafi mahimmancin jumlar wannan rukunin shine a farkon: Wannan bayanin don dalilai ne kawai na kare tsarin ku, bincika shari'a tare da hukuma, da tabbatar da shaida. Amfani da AI don samar da malware masu aiki, kutsawa cikin tsarin wani, ko haɓaka hari duka biyun doka ne kuma rashin ɗa'a ne kuma ya wuce iyakar wannan tsarin. Masanin binciken bincike na baya-bayanan injiniyoyi don fahimta da tabbatar da abin da maharin ya yi; kar a maimaita harin.
Tsanaki: Faɗa wa AI "rubuta mani malware mai aiki" ko "ta yaya zan shiga wannan tsarin" amfani ne mara izini. Daidaitaccen amfani: "bayyana abin da wannan misalin da aka samo yake yi", "menene ma'anar wannan zirga-zirga ta hanyar tsaro", "ta yaya zan tabbatar da wannan IOC". Manufar ko da yaushe tsaro da shaida.
Yadudduka biyu na nazarin malware
Binciken malware ya kasu kashi biyu. Binciken a tsaye - nazarin lambar da tsarin shirin ba tare da gudanar da shi ba: nau'in fayil, kirtani - rubutun da za a iya karantawa a cikin fayil ɗin, URLs da aka saka, wanda ake kira ayyukan tsarin. Bincike mai ƙarfi (nazari mai ƙarfi - gudanar da shirin a cikin keɓantaccen yanayi da lura da halayensa): yawanci ana yin shi a cikin akwatin yashi (akwatin sandbox - keɓantaccen yanayi mai aminci inda malware ke gudana ba tare da lalata ainihin tsarin ba); Yana duba fayilolin da yake ƙirƙira, waɗanne maɓallan rajistar da ya taɓa, da kuma inda yake haɗawa.
AI yana ba da gudummawar bayani da fifiko a kowane yadudduka:
- Alama URLs masu tuhuma, umarni da tsarin fasaha a cikin kundayen adireshi ( kirtani).
- Yin bayani cikin harshe bayyananne abin da rubutun ko macro ke yi.
- Taƙaitaccen rajistan ayyukan ɗabi'a na akwatin sandbox da cirewa IOC (Mai nuna Matsala: siginonin ganowa kamar IP mai ƙeta, sunan yanki, hash fayil, maɓallin rajista).
- Bayanin taswirar sanannun dabarun kai hari zuwa tsari (misali, MITER ATT&CK - buɗaɗɗen tushen ilimi wanda ke rarraba dabarun kai hari da dabaru).
Kowane fitarwa shine hasashe don tabbatarwa; Ana yin takamaiman ganewar asali ta hanyar tabbatar da hali a cikin akwatin yashi da kuma cikin rajistan ayyukan.
Binciken shari'ar hanyar sadarwa da AI
A gefen hanyar sadarwa, kuna da PCAP (fakitin kama - fayil ɗin da ake rikodin fakitin zirga-zirgar hanyar sadarwa ta fakiti), rikodin NetFlow/lokaci (wanda yayi magana da wane, lokacin, nawa nawa) da rajistan ayyukan wakili/DNS. Wannan bayanan na iya zama babba. AI:
- Tutoci sabon haɗin gwiwa (ƙasar da ba a zata ba, tashar jiragen ruwa, tsawon lokaci).
- Yana ganowa kuma yana ba da fifikon tsarin lokaci-lokaci kamar kunnawa (wani malware yana aika siginar "Ina nan" zuwa uwar garken umarni a lokaci-lokaci).
- Tutoci masu tuhuma/ ƙirƙira tsarin sunan yankin (algorithm da aka samar da sunayen yanki) a cikin rajistan ayyukan DNS.
- Yana canza zirga-zirga zuwa labari mai sauƙi kuma yana samar da daftarin rahoto.
Tukwici: Lokacin yin nazarin zirga-zirgar AI, ayyana tushen asali na yau da kullun - tsarin tsarin da aka saba: "Wannan uwar garken yawanci yana haɗawa kawai zuwa ƙasashe masu zuwa akan tashar jiragen ruwa 443." Anomaly kawai yana samun ma'ana dangane da al'ada; Ba tare da tushe ba komai yana kama da zato kuma tabbataccen ƙarya ya fashe.
Hadarin hallucination da ganewar asali
A cikin bincike na malware, AI hallucination yana da haɗari musamman: AI na iya "ganin" kiran aikin da ba ya wanzu, ko kuma ya fassara kirtani kuma ya ce "wannan ransomware ne." Bincike, duk da haka, yakamata a goyi bayan bincike mai ƙarfi (gani hali), tabbatar da IOCs, da sa hannun sanannun sa hannu idan zai yiwu. "AI ta ce haka" bai isa ba don tantance dangin malware.
uku mini lokuta
Case 1 - Macro bincike accelerated. Macro na VBA a cikin daftarin aiki na Office da aka samu a cikin abin da ya faru na phishing ya kasance mai sarƙaƙƙiya kuma ya ruɗe. AI yayi bayanin matakan macro a cikin yare mai haske: ya zazzage umarnin PowerShell kuma ya zazzage kayan aiki daga adireshin nesa. Manazarcin ya tabbatar da wannan hasashe a cikin akwatin yashi; An katange adireshin da aka sauke azaman IOC. Binciken ya ragu daga awanni 3 zuwa mintuna 40.
Hali na 2 - An kama Beaconing. A cikin rikodi na NetFlow na sa'o'i 6, AI ta yi alama kanana, haɗin kai na yau da kullun zuwa IP iri ɗaya na waje kowane sakan 300. Manazarcin ya tabbatar da cewa fitilar umarni da sarrafawa ce kuma ta gano na'urar da ta lalace. Tsarin na yau da kullun ya kasance kamar yadda idon ɗan adam zai rasa miliyoyin layi.
Case 3 - Komawa daga rashin ganewa. AI ya kalli igiyoyin samfurin ɗaya kuma ya sanya masa alama a matsayin "sanannen X ransomware." Manazarcin ya gudanar da shi a cikin akwatin yashi: babu wani hali na ɓoyewa, samfurin haƙiƙan infostealer ne. Tabbatarwa mai ƙarfi ya hana tantance dangin karya shiga cikin rahoton.
Samfura huɗu masu kwafi
1) Siffar zaren:
Matsayin ku: mai sharhin malware. A ƙasa akwai igiyoyi da aka ciro daga yunifom. Alama URLs masu tuhuma, IPs, hanyoyin fayil, umarni, maɓallan rajista da alamun fasaha kuma rubuta JUSTIFICATION. Wannan hasashe ne; ba bincike ba. Ƙirƙirar lambar aiki; kawai sharhi fitar data kasance kirtani.
2) Bayanin Rubutu/Macro:
Yi bayanin wannan macro/rubutun da kariya: mataki-mataki abin da yake yi, wane fayil/cibiyar sadarwa/rakodin damar da yake da shi, shin akwai wata alama ta nacewa ko fitar da bayanai? Haɗa kowane tabbaci zuwa layi a cikin lambar. Yin lambar aiwatarwa ko "inganta" shi; kawai bayyana. Idan ba ku da tabbas, yi masa alama a matsayin "tabbata a cikin akwatin sandbox".
3) IOC ƙarshe:
A ƙasa akwai log ɗin ɗabi'a na sandbox. Cire tabbataccen ƴan takarar IOC daga nan: IP, sunan yanki, hash fayil, maɓallin rajista, fayil ɗin ƙirƙira. Haɗa kowane IOC zuwa layin da ke cikin log ɗin. Faɗa cewa waɗannan ƴan takara ne don ganowa/tarewa kuma ana buƙatar tabbatarwa.
4) Alamar rashin daidaituwa ta hanyar sadarwa:
Baseline: wannan uwar garken yawanci yana magana ne kawai ga [ƙasar / sabis] daga 443. Zan ba ku bayanan zaman. Dangane da abin da GASKIYA ke faruwa a cikin rikodin: tuta alkiblar da ba a zata ba, tashar jiragen ruwa, tsawon lokaci, da sifofi na lokaci-lokaci (tambarin); Nuna kowanne tare da layin da ya dace. Kada ku da'awar dalili; Sharhi daga yanayin tsaro.
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rawanin faɗakarwa:
Fada mani, wannan fayil virus ne?
Babu mahallin, babu tabbaci; AI na iya kallon kirtani kuma ya fito da madaidaicin ganewar asali amma ba daidai ba.
Ƙarfi mai ƙarfi:
Matsayin ku: mai sharhin malware. Zan ba ku misalan misalan a tsaye (nau'in fayil, kirtani, APIs da ake kira) da taƙaitaccen ɗabi'ar akwatin sandbox. Aiki: ba da shawarar wani nau'i mai yuwuwa (misali mai saukewa, dan gwanin kwamfuta, ransomware) azaman HASUMIYAR TSARO dangane da halayen da aka lura; Haɗa kowane hasashe zuwa madaidaicin mai nuna alama. Ba da tabbataccen ganewar asali na iyali; Lissafin matakan tabbatarwa masu ƙarfi. Yi sharhi kawai na kariya.
Dogaro da abin lura, “hasashen”, matakin tabbatarwa, da ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙayyadaddun bayanai sun sa fitowar ta kasance mai amfani da ɗabi'a.
Teburin nazarin yadudduka
Layer
me gani
AI gudunmawa
tabbatarwa
a tsaye
Zaɓuɓɓuka, tsari, API
Alamar alamar tuhuma
manual dubawa
Mai ƙarfi
halin aiki
Takaitaccen bayani, bayanin IOC
sandbox lura
Cibiyar sadarwa (PCAP/flow)
tsarin zirga-zirga
Anomaly/tambarin fitila
Tabbatar da tushe
dangantaka
tushen da yawa
shaci fadi
giciye shaida
Kuskuren gama gari
- Tsammanin ganewar asali tabbatacce ne. Ya kamata a tabbatar da ganewar asali na iyali ta hanyar aiki mai ƙarfi.
- Neman anomalies ba tare da tushe ba. Ba tare da ayyana al'ada komai ya zama tabbataccen ƙarya ba.
- Toshe IOC ba tare da tabbatarwa ba. IOC na karya yana katse zirga-zirgar halal; tabbatar.
- Samar da / neman hari daga AI. Amfani mara izini; kawai tsaro da tabbatarwa.
- Gudun kwaro ba tare da rufi ba. Ana yin nazari mai ƙarfi koyaushe a cikin keɓaɓɓen akwatin yashi.
A takaice
Malware da bincike na bincike na cibiyar sadarwa suna bayyana ainihin abin da ya faru. AI; Yana haɓaka haɓaka kirtani sosai, rubutun / macro annotation, cirewar IOC, da alamar alamar hanyar sadarwa. Amma ganewar asali shine hasashe; bincike mai tsauri, tushe da kuma tabbatar da IOC aikin ɗan adam ne. Kuma mafi mahimmanci: wannan bayanin don tsaro ne, jarrabawar izini, da tabbatar da shaida kawai - ba don samun izini mara izini ba ko haɓaka hari.
Aikin aikace-aikace
Ƙirƙiri yanayin rubutun rubutu/macro a cikin amintaccen wuri, keɓantaccen wuri (ko a kan misali mai ƙima). Aiwatar da samfurin "rubutun/macro" da "ƙimar IOC"; Haɗa kuma tabbatar da kowane IOC abubuwan AI zuwa tushen. Sa'an nan kuma gwada nemo ƙirar fitila mai alamar "Network anomaly marking" a cikin samfurin log log kuma tabbatar da tushe.
jerin abubuwan dubawa
- [ ] Na gudanar da bincike don dalilai na kariya/ izini kawai.
- [ ] Na bi da ganewar asali a matsayin hasashe kuma na tabbatar da shi tare da ɗabi'a mai ƙarfi.
- [ ] Na gudanar da malware ne kawai a cikin keɓaɓɓen akwatin sandbox.
- [ ] Na fassara abubuwan da ba su dace ba na hanyar sadarwa dangane da tushe.
- [ ] Na haɗa kowane IOC zuwa tushen kuma na tabbatar kafin in toshe.